Topic starter
09/07/2026 3:23 pm
TL;DR: Stolen OAuth tokens from the Salesloft Drift app let an attacker log into hundreds of Salesforce tenants, enumerate data, export records with Bulk API 2.0, and delete jobs to obscure the trail, according to CYATA and corroborating incident reporting. Token trust, not endpoint compromise, was the failure mode, and that changes how teams should govern connected apps and agent identities.
Editorial analysis by NHI Mgmt Group, based on content published by CYATA: “The Drift breach was not about malware. It was about agentic identity.”.
Key questions
Q: What breaks when a connected app token is stolen?
A: When a connected app token is stolen, the attacker authenticates as the app rather than as a person, so MFA and user login checks often never trigger.
Q: When does OAuth create more risk than it reduces in SaaS environments?
A: OAuth becomes high risk when scopes are broad, tokens are long-lived, and the organization cannot see how the credential is reused across connected apps.
Q: What are the signs that a SaaS-to-SaaS integration has been compromised?
A: Look for unusual query volume, bulk data exports, unexpected changes to integration behavior, and access from unfamiliar infrastructure.
Practitioner guidance
- Inventory every connected app as a governed identity Record the owner, purpose, scopes, tenant locations, and token type for each integration, including SaaS-to-SaaS connections and mailbox-linked automations.
- Shorten refresh token and session lifetimes Treat refresh tokens as high-value secrets, limit their lifetime where the platform allows, and remove blanket long-lived access for integrations that do not require it.
- Correlate token issuance with API and data-access logs Join OAuth server events, connected-app audit data, Salesforce event monitoring, and bulk export logs so unusual issuance or first-use patterns can be detected quickly.
Bottom line: The incident shows that stolen OAuth tokens can turn a trusted SaaS integration into a durable access path without breaking into endpoints.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:41 pm
Connected-app trust is now a primary attack surface: OAuth tokens can turn a SaaS integration into a durable access path that outlives the login event that created it. This incident shows that the real control failure sits in token governance, scope design, and revocation discipline, not in endpoint hardening. The practitioner conclusion is simple: if an integration can act like a user, it must be governed like a privileged identity.
A few things that frame the scale:
- The blast radius of the Salesloft-Drift OAuth supply chain attack was 10 times greater than earlier incidents in which attackers breached Salesforce directly.
A question worth separating out:
Q: What should teams do when cloud tokens or integrations are suspected to be compromised?
A: Revoke the token or integration immediately, then trace what systems it could reach and what data it could access. Rotate related secrets, disable unnecessary scopes, and validate backups or keys were not altered. Treat the token as a compromised identity, not a simple configuration issue.
👉 Read our full editorial: OAuth token abuse turned Salesloft Drift into a Salesforce breach